Bound BanManager registry lifetime with a TTL

[sascha-egerer]

The per-rule audit registry was written without a TTL, so it accumulated entries across ban churn until something called listBans() or clearBans() pruned them. Each save now carries a TTL matching the longest-surviving entry and prunes already-expired entries before writing. Concurrent ban() calls for the same rule can still drop one of the registry entries, which is acceptable because the primary ban cache key set by ban() is the source of truth and is unaffected by the race.

[Copilot]

Pull request overview

This PR bounds the per-rule ban audit registry lifetime by applying a TTL to the registry cache entry and pruning expired entries on every save, preventing unbounded growth across ban churn.

Changes:

• Add a BanManager unit test asserting the ban registry cache key expires alongside the bans it tracks.
• Refactor BanManager::registerBan() to reuse loadRegistry() / saveRegistry() and update saveRegistry() to prune expired entries and set a TTL equal to the longest remaining ban lifetime.
• Document the behavior change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/Unit/BanManagerTest.php	Adds a TTL-focused test for the ban registry cache entry.
src/BanManager.php	Prunes expired registry entries on save and writes the registry with a TTL to prevent unbounded growth.
CHANGELOG.md	Notes the registry TTL + pruning behavior under Unreleased.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.